Disable NAT-T in Checkpoint GW.

[Matlu]

Hello,

Is NAT-T enabled by default on Checkpoint equipment?

We have a GW, where we have created multiple VPNs with other clients, but specifically, with 1 client (Cisco ASA), we are having communication problems and according to the tests that the endpoint performs, suggests us to "disable" the NAT-T, but this option of disabling the NAT-T in the GW, affects in general to all the VPNs that you have created, right?

Could someone please confirm this for me.

Greetings.

[the_rock]

Ikev2 is way better and more secure, but give it a try.

[Zolocofxp]

IKEv1 will be a lot easier to debug. You will have to open legacy_ike.elg in IKEView.

[the_rock]

I believe process is the same for ikev2 as well, at least based on TAC cases I had in the past.

Andy

[Matlu · Accepted solution]

We found the error, and fixed it.

It's weird, but we'd better not even touch it, hahaha.

It turns out, we touched the configuration of the

"VPN TUNNEL SHARING"

Select the option: "One VPN Tunnel per each pair of hosts" .... Once this option was selected, it started to work.

Checkpoint really surprises me 🤣😲

We were seeing the traffic coming out of the encrypted firewall, and everything was fine for us, but the Cisco ASA was not seeing the traffic coming to their equipment, and we had to move to that option, once we did that, it started to work normally.

I really don't understand why, but at least it is working. 🙃

[the_rock]

Dont touch it bro, let it be 🙂

GOOD JOB! 👍👍

Andy

[the_rock]

Btw, just a comment, keep in mind, this is not necessarily CP issue, I had seen this being needed because of Cisco in the past.

Regardless, now you know to try those options if you ever have this problem in the future 😉

Andy

[Matlu]

Yes, I think so.

Although I still believe as you do, that the best option, when you have a mix on both sides of the VPN of segments and hosts, the best is to use the "... per Gateway pair", but today, it didn't feel like working well, HAHAHAHA.

It is useful for the notes. 😂🤣

[the_rock]

I hear ya bro :). Trust me, even with lots of other vendors, sometimes, the most logical option is NOT the one that works haha

Andy

[the_rock]

You can review both actually...vpn debug trunc command "resets" those files anyway.

Andy

[PhoneBoy]

You are correct that, in releases prior to R80.10, that Check Point gateways will never initiate NAT-T (except SMB gateways that always have).

[Matlu]

So, nowadays, in version from R80.20 onwards, the GW Checkpoint, have the ability to "INITIATE" the communication on the NAT-T?

What is the default behavior of a GW with NAT-T enabled?
Is it in listening mode, or can it be the one that initiates this traffic?

[PhoneBoy]

Yes, Check Point gateways can initiate NAT-T from R80.10 and above.
The option should be enabled by default.

[the_rock]

Did you confirm nat option inside vpn community?

Andy